SYSTEM AND METHOD FOR IMPLEMENTING BEHAVIORAL 

OPERATIONS 



Related Applications 

This patent claims priority on the provisional patent application 
entitled "Behavioral Set and Field Descriptor Implementations in DPP", 
serial No. 60/240,028, filed October 13, 2000, assigned to the same 
assignee as the present application. 

Field of the Invention 

The present invention relates generally to the field of computer 
searching systems and more particularly to a system and method of 
behavioral operations. 

Background of the Invention 

It is commonly required in computers to find a particular string of 
data. For instance, a user might want to identify all of his documents 
that have a particular word. The computer creates a window the size of 
the word and starts searching all the files on the computer's hard disk 
for the word. Another example is firewalls and anti- virus programs. 
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Unfortunately, the user might be looking for several words of differing 
lengths or signatures having different lengths. As a result the computer 
has to create search windows of differing lengths. Assume one search 
window is three bytes and a second window is four bytes. We have to 
5 form two comparisons for each new byte of data. One comparison that 
contains the new byte of data and two old bytes of data and a second 
comparison that contains the new byte of data and three old bytes of 
data. This is a very processor intensive process. Note that if several 
three byte words (addresses) are being search for, the process requires a 

10 comparison for each of these words. 

In addition to these problems it often happens that the items being 
searched for is not the final item required, but a trigger for the search to 
proceed in another direction or under different circumstances 
(behavior). For instance, network data is often contained in packets. 

15 The information that the user wants to scan is contained in the data 

portion of the packet, however it is common to have multiple types of 
packets encased in the packet. The search has to skip over the header 
information for all the encapsulated packets and find the actual data. 
Present solutions to this problem use groups of finite state machines 

20 (FSA - finite state automata). Unfortunately, when the number of 
possibilities to be examined expands the number of PSAs and their 
connections grow exponentially. This means that the programmers' 
efforts grow exponentially and the possibility of mistakes grow 
exponentially. 

25 Thus there exists a need for a search process has the flexibility to 

deal with complex searching problems. 
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Brief Description of the Drawing s 

FIG. 1 is a schematic diagram of a sliding window search routine in 
accordance with one embodiment of the invention; 
5 FIGs. 2 & 3 are a flow chart of the steps used in performing a 

sliding window search in accordance with one embodiment of the 
invention; 

FIGs. 4 & 5 are a flow chart of the steps used in performing a 
sliding window search in accordance with another embodiment of the 
10 invention; 

FIG. 6 is a flow chart of the steps used in performing a sliding 
window search in accordance with another embodiment of the invention; 

FIG. 7 is a flow chart of the steps used in an icon shift function in 
accordance with one embodiment of the invention; 
15 FIG. 8 is a flow chart of the steps used in an icon unshift function 

in accordance with one embodiment of the invention; 

FIG. 9 is a flow chart of the steps used in a transform function in 
accordance with one embodiment of the invention; 

FIG. 10 is a flow chart of the steps used in an untransform function 
20 in accordance with one embodiment of the invention; 

FIG. 11 is an example of a transform lookup table; 
FIG. 12 is an example of a transform translation table; 
FIG. 13 is a block diagram of a system for associative processing in 
accordance with one embodiment; 
25 FIG. 14 is a linear feedback register used to calculate an icon (CRC, 

polynomial code) in accordance with one embodiment of the invention; 



